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Introduction 


The Information Commissioner (the Commissioner) is 
calling for evidence and views on the Age Appropriate 
Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 
(the Act). The Act supports and supplements the 
implementation of the EU General Data Protection 
Regulation (the GDPR). 


The Code will provide guidance on the design standards 
that the Commissioner will expect providers of online 
‘Information Society Services’ (ISS), which process 
personal data and are likely to be accessed by children, to 
meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code 
she considers to be relevant when exercising her 
regulatory functions. The courts and tribunals will also be 
required to take account of any provisions they consider to 
be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s 
personal data can be found in our guidance Children and 
the GDPR. It will be useful to read this before responding 
to the call for evidence, to understand what is already 
required by the GDPR and what the ICO currently 
recommends as best practice. In drafting the Code the ICO 
may consider suggestions that reinforce the specific 
requirements of the GDPR, or its overarching requirement 
that children merit special protection, but will disregard 
any suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the 
Code. The Act provides that the Commissioner must 
consult with relevant stakeholders when preparing the 
Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. 
She will publish the Code once it has been approved by 
Parliament. 


This call for evidence is the first stage of the consultation 


process. The Commissioner seeks evidence and views on 
the development stages of childhood and age-appropriate 
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design standards for ISS. The Commissioner is particularly 
interested in evidence based submissions provided by: 
bodies representing the views of children or parents; child 
development experts; providers of online services likely to 
be accessed by children, and trade associations 
representing such providers. She appreciates that different 
stakeholders will have different and particular areas of 
expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only 
address questions within these areas, as well as those that 
address every question asked. She is not seeking 
submissions from individual children or parents in this call 
for evidence as she intends to engage with these 
stakeholder groups via other dedicated and specifically 
tailored means. 


The Commissioner will use the evidence gathered to inform 
further work in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such 
standards of age appropriate design as she considers to be 
desirable, having 

regard to the best interests of children, and to provide 
such guidance as she considers appropriate. 


In exercising this discretion the Act requires the 
Commissioner to have regard to the fact that children have 
different needs at different ages, and to the United 
Kingdom's obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed 
to supporting the Commissioner in her development of the 
Code by providing her with a list of ‘minimum standards to 
be taken into account when designing it.’ The 
Commissioner will have regard to this list both in this call 
for evidence, and when exercising her discretion to develop 
such standards as she considers to be desirable 


In developing the Code the Commissioner will also take 
into account that the scope and purpose of the Act, and 
her role in this respect, is limited to making provision for 
the processing of personal data. 
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Responses to this call for evidence must be submitted by 
19 September 2018. You can submit your response in one 
of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the call for 
evidence please telephone 0303 123 1113 and ask to 
speak to the Engagement Department about the Age 
Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received 
from organisations but will remove any personal data 
before publication. We will not publish responses from 
individuals. For more information about what we do with 
personal data please see our privacy notice. 
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Section 1: Your views and 
evidence 


Please provide us with your views and evidence in the 
following areas: 


Aspects of design 


The Government has provided the Commissioner with a list 
of areas which it proposes she should take into account 
when drafting the Code. 


These are as follows: 

e default privacy settings, 

e data minimisation standards, 

e the presentation and language of terms and 
conditions and privacy notices, 

e uses of geolocation technology, 

e automated and semi-automated profiling, 

e transparency of paid-for activity such as product 
placement and marketing, 

e the sharing and resale of data, 

e the strategies used to encourage extended user 
engagement, 

e user reporting and resolution processes and 
systems, 

e the ability to understand and activate a child’s right 
to erasure, rectification and restriction, 

e the ability to access advice from independent, 
specialist advocates on all data rights, and 

e any other aspect of design that the commissioner 
considers relevant. 


Q4. Please provide any views or evidence you think the 
Commissioner should take into account when explaining 
the meaning and coverage of these terms in the code. 


There have been shifts towards privacy by design for young people with a number of 
social media sites in recent years. For instance Facebook sets default privacy settings as 
standard for users between the ages of 13-18. 


Positive progress has been made within the wider sector to develop guidance for ISS 
providers and make recommendations on many of these aspects of design. For instance, 
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The Diana Award is a member of the UK Council for Child Internet Safety (UKCCIS) which 
has published a number of good practice recommendations for industry’. 


However ISS providers can and should go further in design features to safeguard 
underage users. Members of our National Anti-Bullying Youth Board made the following 
recommendations for design features to assist in the safeguarding of children: 


e “Add a’report abuse’ button to everything, meaning offensive comments can 
be flagged to moderators easily 
Having higher privacy settings when you first join apps e.g. Snap Maps 
turned off 
automatically set accounts to private when you first join 
Don't allow people that are not friends to direct message the person 


Employ specially trained child and adolescent moderators to monitor use of 

social media more closely 

Add links to supportive agencies/helplines within their geographical location 

Strict privacy settings [for younger users] should be set by default” 
-National Anti-Bullying Youth Board Members, 14 and 15 


We have outlined below a number of further recommendations and points to consider 
when it comes to deciding on the scope and meaning of the terms listed in the Code. 


Privacy Settings 


Social media sites must embed high levels of safety and privacy into children’s user 
journey as standard. Whilst some sites such include default privacy settings for users 
aged 13-18, other features, such as needing to opt-out of geolocation on Snapchat, may 
put younger users unknowingly at risk: 


“| feel the most dangerous thing [online] is your information being shared, such as 
Snap Maps on Snapchat and also quick add on Snapchat. 
| also feel when you sign up for apps privacy settings are low and sometimes people 


don't know that meaning they could be sharing more information than they think.” 
— National Anti-Bullying Youth Board Member, 15 


Safety features such as Ghost Mode on Snapchat should always be set as ‘on’ by default 
for under-18s, rather than the automatic sharing of sensitive location data. Similarly any 
apps that track a child’s location must highlight that it is doing so, for instance with a 
notification or other indicator. 


Children should have full control of their privacy online, and the implications of changing 
privacy settings must be made clear and explained in an accessible way at every stage of 
the user journey. 


Paid-for content 


Whilst there has been developments towards transparency of paid-for activity, such as 
with the requirement to add ‘#ad’ to sponsored social media posts, the evidence suggests 
that young people still struggle to identify this in practice.2 Clearer identifying features are 
essential to help children distinguish between original and paid-for content. 


Children’s data should not be used for commercial purposes, and features such as the 
ability to disable in-app purchases and still be able to use apps or games should be made 
accessible as standard. 


Reporting 
‘https://assets. publishing.service. gov.uk/government/uploads/system/uploads/attachment 
data/file/251456/industry guidance social_networking. pdf 


2 https://Awww.ofcom.org.uk/ _data/assets/pdf_file/0020/108182/children-parents-media- 
use-attitudes-2017. pdf 
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Through working with thousands of young people across the UK, we recognise that there 
is a widespread lack of trust and confidence in the report functions of social media sites. 
Many young people simply do not believe that it is effective. 


ISS providers can do more to mitigate this concern by ensuring that reporting is presented 
in a youth-friendly way, for instance with video content, as The Diana Award has done with 
this video which explains the process of reporting on Facebook. This information must be 
easily accessible and explain the chain of events which follows a report of content. 


Advice from specialists 


Whilst the ability to access advice from independent specialists on data rights is included 
in terms listed in the code, we believe that this list overlooks the role that specialists have 
to play in a wider area. ISS providers have a key role to play in signposting vulnerable 
users to specialist sites. For instance, users who search for ‘reporting’ or ‘bullying’ should 
be met with easily accessible links to relevant services and guidance. 


As one member of our National Anti-Bullying Youth Board illustrates, ISS providers must 
work collaboratively with experts to protect younger users: 


“Social media/gaming and online companies need to act in an ethically responsible 
way and ensure children and adolescents safe development. They need to work in 
partnership with parents/leaders/governmental bodies to promote a better, safer 


society. The 24/7 nature of social media companies and the feeling they are unable to 
escape the bullies even at home can leave young people struggling to cope.” 
— National Anti-Bullying Youth Board Member, 15 


Terms and Conditions and Privacy Notices 


Whilst it is widely acknowledged that T&Cs are particularly inaccessible for younger users 
and are routinely ignored, there has been a lack of innovation across the board in ways to 
ensure that children and young people understand the terms of use of the platform they 
are using. Lengthy documents are ineffective: online platforms need to ensure they are 
presenting important information in a child-friendly way. 


This should be implemented for all services likely to be accessed by children, regardless 
of minimum age limits on platforms. Key developments should include introducing a 
maximum reading age of 13 for all language used in these notices, as well as more video- 
focussed content, for instance an online safety demo video for younger users. 


Extended User Engagement 


We have been pleased to see shifts towards a focus on ‘quality over quantity’ when it 
comes to time spent online, for instance with the introduction of the ‘You're all caught up’ 
feature on Instagram. 


However persuasive design features, such as auto-play, notifications and Snapchat 
streaks, must be removed for users who are likely to be highly affected by them (e.g. 
under 13’s). Persuasive design features should be clearly indicated and appropriate 
provisions made for users under the age of 18, for instance having default timeout 

settings, reminders of time spent online, and most notifications set to ‘off by default. 


Extended user engagement features such as these are likely a contributing factor to the 
fact that a recurrent finding from our research is the extent to which young people can 
often feel ‘hooked’ to their devices. Staff and young people who have taken part in our Be 
Strong Online Ambassadors training, a digital resilience programme run by The Diana 
Award in partnership with Vodafone, are asked to share their perceptions of a variety of 
online issues affecting young people. 'Excessive tech use’ is one of the issues most 
frequently experienced: 


e 70% of young people had seen their peers affected by excessive tech/internet 


use or feeling ‘hooked’ to a device at least a few times a month, with 35% having 
witnessed this ‘daily’ 
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e 75% of staff members had seen students experiencing excessive tech/internet 
use or feeling ‘hooked’ to a device at least a few times a month, with a quarter 
seeing this on a daily basis 

N= staff members: 116, young people aged 11-18: 974 


"| think that there IS such thing as excessive use of social media. Young people are 
using phones for hours every day and it is steadily increasing. It is even affecting 


school work and exam scores" 
— National Anti-Bullying Youth Board member, 13 


A 2017 YouGov poll? conducted by The Diana Award in partnership with ASKfm revealed 
the extent of pressure to be connected online: 

e 53% of young people had felt they had to stop what they were doing (e.g. 
reading, studying, watching TV etc.) to respond to a message online in the past 
six months 

e 49% had felt the need to reply to people's messages quickly (e.g. to keep up with 
a Snapchat Streak etc.) in the past six months 


These findings hint at the social pressures felt by young people online. Social media sites 
should take this pressure into account when designing notification systems in apps likely 
to be used by younger users, and distinguish the impact that reward mechanisms may 
have on young people compared with adult users. 


Q5B. about how the ICO, working with relevant stakeholders, might 
use the opportunities presented and positively address any 
challenges you have identified. 


There is a clear role for educators to play in reinforcing the key principles of the Code. For 
instance, the PSHE, Computing and SRE curricula have clear links to areas set out in this 
proposal. Resources should be allocated to ensure that the Code is backed up by the 
education efforts that must go alongside changes to the way ISS providers design their 
services for children. 


“| believe that young people need to become more aware of the benefits and dangers 
of social media by the social media platforms advertising this themselves, or schools 
bringing a certain element of this teaching into their curriculum as it would improve 
literacy skills. It would help the young adults to expand their knowledge on how to stay 
safe online and could possibly help in eliminating any issues that might arise, as the 
users would be educated in as to how they can stay safe. [...] Social media companies 


should contribute to media education and this should be developed as part of teaching 
information and computer technology in schools and communities. Implementing media 
education pupils media literacy skills can be developed, including the control of tools 
and learning to use them appropriately.” 

- National Anti-Bullying Youth Board Member, 14 


We would encourage a focus on the benefits of peer-led learning in this approach. The 
Diana Award we believe that young people are the best agents for change in their schools, 
communities and online. Our peer-to-peer programmes equip young people to help others 
tackle issues they are facing online, whether it is cyberbullying and online negativity or 
other challenges such as feeling hooked or pressured to be online. Young people should 
be empowered to equip their peers with the skills required to navigate the online world 
safely. 


3 hte //wwwrentibullyinagpro-com/blog/2018/2/1/the-diana-awordl- 


CH = io 
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We would recommend embedding peer-to-peer education and clear, practical resources 
for schools into key messaging which may arise as a result of the introduction of the Code. 


Q6. If you would be interested in contributing to future solutions focussed work in 
developing the content of the code please provide the following information. The 
Commissioner is particularly interested in hearing from bodies representing the 
views of children or parents, child development experts and trade associations 
representing providers of online services likely to be accessed by children, in this 
respect. 


Nene as 
Email: EE diana-award. org.uk 


Brief summary of what you think you could offer 


How The Diana Award’s work ties in to the subject of this consultation 


Established in 1999, The Diana Award is a charity legacy to Princess Diana’s belief that young people have the power to 
change the world. 


Through our work delivering peer-led training programmes, we have empowered tens of thousands of young people with 
the skills, confidence and knowledge to change the culture and attitudes around bullying on and offline. We equip them with 
the necessary tools to promote online safety and digital resilience to their peers and to tackle the online issues that matter 
most to them. 


For a number of years we've worked closely with tech companies to amplify the voices of young people in debates around 
online safety. We work closely with a number of social media platforms, telcos and online gaming companies to ensure 
that young people are central to shaping their safety policies and developing new interventions. 


Increasingly our work focuses on how young people live their lives online and how they can balance the positive 
opportunities afforded by the digital world with an appreciation and understanding of the risks. Online privacy is a complex 
area for children and young people to navigate and whilst education programmes have a crucial role to play, there are 
undoubtedly improvements that need to be made. Privacy and safety by design must be embedded into online services 
and products that children and young people are likely to access. 


The Diana Award’s work therefore has a number of important implications on the subject of this call for evidence, and have 
gathered input from a number of young people who form our National Anti-Bullying Youth Board. 


“The child is a user who enjoys, experiences, consumes, interprets and plays. 
Secondly, the child is an expresser who draws, depicts, presents and writes. 
Furthermore, the child is a participant who operates and influences. 


And what is important, the child is the person in need of media protection.” 
- National Anti-Bullying Youth Board Member, 14 
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section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 
The Diana Award 


A body representing the views or interests of parents? 
Please specify: 


A child development expert? 
Please specify: 


A provider of ISS likely to be accessed by children? 
Please specify: 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 


Other? 
Please specify: 
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ABOUT OUR WORK 


The Diana Award Anti-Bullying Ambassador Programme 


The Anti-Bullying Ambassador Programme empowers students and staff through a 
holistic and peer-led approach to tackle bullying. In 2011, the programme received 
funding from The Department for Education (DfE) and has trained over 25,000 young 
people as Anti-Bullying Ambassadors. 


Through regional training days and bespoke visits, schools are trained alongside other 
schools in the local area and students become Anti-Bullying Ambassadors in their 
schools. The training events help Anti-Bullying Ambassadors and other young people by 
building their skills and confidence to change the attitudes, behaviours, and culture of 
bullying, both online and offline. 


Following their training, the Anti-Bullying Ambassadors help re-educate their peers on the 
facts behind bullying, lead on anti-bullying campaigns, promote a culture which celebrates 
and tolerates difference and help keep their peers safe both online and offline. 98% of 
Anti-Bullying Ambassadors felt that the programme had provided young people with a 
stronger voice to tackle bullying, and 100% of staff members were confident in their ability 
to recognise the different forms of bullying and how to address bullying issues in their 
school. 


Anti-Bullying Ambassadors have run campaigns in their school to raise awareness of 
bullying issues and to become positive role models to their peers. 


For an example of Anti-Bullying Ambassadors in action running online safety campaigns 
across the UK and Ireland click here‘. 


For more information please visit www.antibullyingpro.com. 
The Be Strong Online Ambassadors Programme 


Be Strong Online is a peer-led digital resilience programme to help young people explore 
the digital world safely. The programme was developed The Diana Award and Vodafone 
and is run in partnership with schools. 


Be Strong Online includes free resources on 10 learning modules, covering online issues 
such as cyberbullying, digital footprint, digital detox, selfies and self-esteem and social 
media. Each module contains the resources young people need to deliver short, 
interactive sessions on these topics with their peers. 


Since 2016 over 1200 young people and staff members have been trained as Be Strong 
Online Ambassadors. These training events explore the issues currently facing young 
people online, what the role of a Be Strong Online Ambassador is, and how to roll out the 
programme in schools and deliver peer-led activities. 95% of Be Strong Online 
Ambassadors were confident that as a result of the training they could help students be 
safer online, and 95% of staff members were confident that the Be Strong Online 
Ambassadors programme could run successfully in their school and make a positive 
change. 


Be Strong Online Ambassadors have run campaigns in their school to raise awareness 
digital resilience and to become positive online role models to their peers. 


4 https://www.youtube.com/watch?v=t1AompZFwgg&feature=youtu.be 
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For more information on the programme please visit 
www. antibullyingpro.com/bestrongonline. 


ASOS 


The Diana Award has worked together with ASOS since 2015 to run self-esteem and 
body confidence workshops for young people. The #MySenseOfSelf project explores 
young people's perceptions of body image and in particular the connection between social 
media and self-esteem. 


Body image dissatisfaction in the UK has never been higher, and a huge amount of young 
people struggle with the issue. Around half of girls and up to one third of boys have dieted 
to lose weight, and over half of bullying experienced by young people in a recent study 
was because of appearance. 


The Diana Award teamed up with ASOS to create a teaching resource and workshop with 
was delivered to over 800 young people across the UK in 2017. 


For more information on this project please visit http:/Avww.antibullyingpro. com/asos-sign- 
up/. 


Facebook 


Facebook has supported The Diana Award since 2010. As part of the partnership, 
Facebook supports The Diana Award in training their ‘Anti-Bullying Ambassadors’ in 
schools across the UK, and also supports the charity in the production of national events 
during UK Anti-Bullying Week where the Facebook safety team trains over 500 young 
people and teachers on safety on Facebook. Facebook also provides safety training for 
each new Youth Board that is elected every year. In 2016 Facebook launched a resource 
‘Anti-Bullying Activism on Facebook’ — a guide for schools who would like to set up their 
own anti-bullying initiatives on Facebook. 


To find out more about The Diana Award’s partnership with Facebook go to: 
http://facebook. antibullyingpro.com/. 


SELMA 


The Diana Award is one of the six European partners who comprise the SELMA (Social 
and Emotional Learning for Mutual Awareness) project. 


Set up in 2017, SELMA aims to promote mutual awareness, tolerance and respect, 


through a holistic empowerment approach, which tackles online hate, most notably in 
schools but also in out-of-school communities that impact well-being. 


V1.0 20180626 


SELMA builds upon a Social and Emotional Learning approach to empower young people 
to become agents of change; it helps them to better understand the phenomenon of 
online hate; it provides them with tools and strategies to act and make a difference and it 
draws upon on the Diana Award’s unique peer-to-peer learning approach to behaviour 
change. 


Activities include: 


e Empirical research 

e The co-creation of a SELMA Toolkit 

e Face-to-face and online training and counselling for young people 

e = Training/briefings to educational staff/teachers and school leaders as well as 
social workers, parents and other carers, including a Massive Online Learning 
Course (MOOC) 

e Education Task Force meetings for EU policy makers, Ministries of Education 
and IT companies to facilitate mutual learning and cooperation, shaping their 
respective policies, while taking into account the perspective of young people 
and civil society 

e The dissemination of outputs, results and lessons learned. A hackathon, an 
international conference, as well as different online (mini-) campaigns, including 
a final education/awareness week will ensure cross-European outreach 


For more information please visit: http:/Avww.hackinghate. eu/about. 
Stagecoach 


Together with Stagecoach, The Diana Award Anti-Bullying Campaign have launched an 
exciting partnership to deliver a bus tour promoting Anti-Bullying in schools and youth 
groups across the UK. 


The #BeNiceBus tour will visit schools/youth groups to provide a safe space and comprise 
of walk-on workshops delivered to young people aged 11-18, to explore the impact of 
cyberbullying. These interactive workshops will encourage young people to think about 
their actions, offer advice to young people experiencing cyberbullying, and invite students 
to sign an anti-bullying pledge. 


ASKfm 


ASKfm partnered with The Diana Award in 2015. As part of the partnership, both 
organisations reaffirmed a commitment to empowering thousands of young people across 
the United Kingdom and Ireland to make positive choices on social media in order to build 
an online culture that provides the support and insights they are seeking through a peer- 
led approach. 


This is achieved through safety resources to help young people become more aware of 
the impact that online communications have on themselves and others. One of these 
resources, “The Power of Questions” is a 45 minute interactive session that focuses on 
raising awareness about the opportunities and possible issues with online anonymity as 
well as what young people can do if they experience cyberbullying. Other resources are 
articles ranging from ‘what to do if you’re being cyberbullied’, ‘what to do if you receive 
negative comments’, ‘what to do if you’re worried about your digital footprint’ through to 
‘what to do if you are setting up a brand new social media account’. 


For more information please visit http://askfm.antibullyingpro.com/ 


Thank you for responding to this call for evidence. 
We value your input. 
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